Keycloak SAML SOAP endpoint unbounded XML parsing allows denial of service

Summary

Keycloak's SAML Artifact Resolution and ECP SOAP endpoints do not limit the size or complexity of incoming XML. An unauthenticated remote attacker can send large XML messages to exhaust memory and crash the server, denying service to all users; Red Hat build of Keycloak 26.4 and 26.6 and Red Hat Single Sign-On 7 are affected.

What to do

Update the 26.4 line to 26.4.17 and the 26.6 line to 26.6.8 or later. Red Hat Single Sign-On 7 names no fixed version, so check that it runs a newer version and read advisory RHSA-2026:95759.

Update to at least the version for your product:

• Red Hat build of Keycloak 26.4 26.4.17 or later
• Red Hat build of Keycloak 26.6 26.6.8 or later

Products and platforms

• Red Hat build of Keycloak
• Red Hat Single Sign-On 7

CVE IDs

• CVE-2026-82965 (opens in a new tab)

Sources

• Advisory: access.redhat.com (opens in a new tab) · access.redhat.com (opens in a new tab) · access.redhat.com (opens in a new tab) · access.redhat.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-05 17:14 UTC

First seen 2026-11-09 17:00 UTC